#399

backend/spec/services/post_creator_spec.rb

@@ -0,0 +1,82 @@
+require 'rails_helper'
+require 'base64'
+
+RSpec.describe PostCreator do
+  let(:actor) { create(:user, :member) }
+
+  def real_thumbnail_upload
+    gif = Base64.decode64('R0lGODdhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=')
+
+    Rack::Test::UploadedFile.new(
+        StringIO.new(gif),
+        'image/gif',
+        original_filename: 'thumbnail.gif')
+  end
+
+  before do
+    allow(Tag).to receive(:normalise_tags!).and_return({ tags: [], sections: {} })
+    allow(TagVersioning).to receive(:record_tag_snapshots!)
+    allow(Tag).to receive(:expand_parent_tags).and_return([])
+    allow(PostVersionRecorder).to receive(:record!)
+  end
+
+  it 'prefers an explicit upload over thumbnail_base' do
+    allow(Post).to receive(:resized_thumbnail_attachment).and_return(
+        io: StringIO.new('upload'),
+        filename: 'resized_thumbnail.jpg',
+        content_type: 'image/jpeg')
+    expect_any_instance_of(Post).not_to receive(:attach_thumbnail_from_url!)
+
+    post = described_class.new(
+        actor:,
+        attributes: {
+          title: 'title',
+          url: 'https://example.com/post',
+          thumbnail: real_thumbnail_upload,
+          thumbnail_base: 'https://example.com/thumb.jpg',
+          tags: '' }).create!
+
+    expect(post.thumbnail).to be_attached
+    expect(post.thumbnail_base).to eq('https://example.com/thumb.jpg')
+  end
+
+  it 'uses the common remote thumbnail attach path when thumbnail_base is given' do
+    expect_any_instance_of(Post).to receive(:attach_thumbnail_from_url!)
+        .with('https://example.com/thumb.jpg') do |post, _url|
+      post.thumbnail.attach(
+          io: StringIO.new('thumbnail'),
+          filename: 'thumbnail.jpg',
+          content_type: 'image/jpeg')
+    end
+
+    post = described_class.new(
+        actor:,
+        attributes: {
+          title: 'title',
+          url: 'https://example.com/post',
+          thumbnail_base: 'https://example.com/thumb.jpg',
+          tags: '' }).create!
+
+    expect(post.thumbnail_base).to eq('https://example.com/thumb.jpg')
+    expect(post.thumbnail).to be_attached
+  end
+
+  it 'keeps creating the post and records a warning when remote thumbnail fetch fails' do
+    allow_any_instance_of(Post).to receive(:attach_thumbnail_from_url!)
+        .and_raise(Post::RemoteThumbnailFetchFailed, 'サムネール画像を取得できませんでした．')
+    creator = described_class.new(
+        actor:,
+        attributes: {
+          title: 'title',
+          url: 'https://example.com/post',
+          thumbnail_base: 'https://example.com/thumb.jpg',
+          tags: '' })
+
+    post = creator.create!
+
+    expect(post.thumbnail_base).to eq('https://example.com/thumb.jpg')
+    expect(post.thumbnail).not_to be_attached
+    expect(creator.field_warnings).to eq(
+        thumbnail_base: ['サムネール画像を取得できませんでした．'])
+  end
+end

backend/spec/services/post_import_runner_spec.rb

@@ -130,4 +130,23 @@ RSpec.describe PostImportRunner do
 
     expect(result).to include(status: 'skipped', existing_post_id: existing.id)
   end
+
+  it 'returns thumbnail warnings from PostCreator on a created row' do
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([preview])
+    created_post = create(:post)
+    creator = instance_double(
+        PostCreator,
+        create!: created_post,
+        field_warnings: { thumbnail_base: ['サムネール画像を取得できませんでした．'] })
+    allow(PostCreator).to receive(:new).and_return(creator)
+
+    result = described_class.new(actor:, rows: [row]).run.fetch(:rows).first
+
+    expect(result).to include(
+      status: 'created',
+      field_warnings: { thumbnail_base: ['サムネール画像を取得できませんでした．'] }
+    )
+  end
 end

backend/spec/services/preview/thumbnail_fetcher_spec.rb

@@ -48,4 +48,56 @@ RSpec.describe Preview::ThumbnailFetcher do
       expect(described_class.fetch('https://example.com/page')).to eq('jpeg-bytes')
     end
   end
+
+  describe '.fetch_image_response' do
+    it 'rejects an unsafe input URL before HTTP fetch' do
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_raise(Preview::UrlSafety::UnsafeUrl, '安全でない接続先は使用できません．')
+      expect(Preview::HttpFetcher).not_to receive(:fetch)
+
+      expect {
+        described_class.fetch_image_response('https://unsafe.example.com/thumb.jpg')
+      }.to raise_error(Preview::UrlSafety::UnsafeUrl, '安全でない接続先は使用できません．')
+    end
+
+    it 'rejects an unsafe redirect target' do
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_return([URI.parse('https://example.com/thumb.jpg'), ['8.8.8.8']])
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/thumb.jpg')
+          .and_raise(Preview::UrlSafety::UnsafeUrl, '安全でない接続先は使用できません．')
+
+      expect {
+        described_class.fetch_image_response('https://example.com/thumb.jpg')
+      }.to raise_error(Preview::UrlSafety::UnsafeUrl, '安全でない接続先は使用できません．')
+    end
+
+    it 'rejects an oversized image response' do
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_return([URI.parse('https://example.com/thumb.jpg'), ['8.8.8.8']])
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/thumb.jpg')
+          .and_raise(Preview::HttpFetcher::ResponseTooLarge, 'too large')
+
+      expect {
+        described_class.fetch_image_response('https://example.com/thumb.jpg')
+      }.to raise_error(Preview::HttpFetcher::ResponseTooLarge)
+    end
+
+    it 'rejects a non-image content type' do
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_return([URI.parse('https://example.com/thumb.jpg'), ['8.8.8.8']])
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/thumb.jpg')
+          .and_return(
+              Preview::HttpFetcher::Response.new(
+                  '<html></html>',
+                  'text/html',
+                  'https://example.com/thumb.jpg'))
+
+      expect {
+        described_class.fetch_image_response('https://example.com/thumb.jpg')
+      }.to raise_error(Preview::ThumbnailFetcher::GenerationFailed)
+    end
+  end
 end

backend/spec/services/youtube/sync_spec.rb

@@ -10,6 +10,21 @@ RSpec.describe Youtube::Sync do
     allow(sync).to receive(:attach_thumbnail_if_needed!)
   end
 
+  describe '#attach_thumbnail_if_needed!' do
+    it 'uses the common remote thumbnail attach path' do
+      post = create(:post, thumbnail_base: nil)
+      allow(sync).to receive(:attach_thumbnail_if_needed!).and_call_original
+
+      expect(post).to receive(:attach_thumbnail_from_url!)
+          .with('https://example.com/thumb.jpg')
+
+      sync.send(
+          :attach_thumbnail_if_needed!,
+          post,
+          'https://example.com/thumb.jpg')
+    end
+  end
+
   describe '#sync!' do
     it 'returns without fetching video details when no video ids are discovered' do
       allow(sync).to receive(:query_terms).and_return([])